﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="WdbgExts Memory Access"/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>WdbgExts Memory Access</title>

<meta name="MS-HAID" content="WdbgExts_DG_74a148ab-2b3c-46e5-a8c8-99c3c48fcd69.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(1051);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/wdbgexts_memory_access.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="wdbgexts_input_and_output.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="wdbgexts_threads_and_processes.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugging_resources.htm">Debugging Resources</A> &gt; <A href="debugger_engine_and_extension_apis.htm">Debugger Engine and Extension APIs</A> &gt; <A href="writing_wdbgexts_extensions.htm">Writing WdbgExts Extensions</A> &gt; <A href="wdbgexts_extension_design_guide.htm">WdbgExts Extension Design Guide</A> &gt; <A href="writing_wdbgexts_extension_code.htm">Writing WdbgExts Extension Code</A> &gt; </div>
	<div id="winchm_template_title">WdbgExts Memory Access</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>This topic provides a brief overview of how memory access can be performed using the WdbgExts API.  For an overview of memory access in the <a href="#Bookmark192">debugger engine</a>, see <a href="#Bookmark202">Memory</a> in the <a href="#Bookmark193">Debugger Engine Overview</a> section of this documentation.</p>
<h3><a id="virtual_memory"></a><a id="VIRTUAL_MEMORY"></a>Virtual Memory</h3>
<p>The virtual memory of the target can be read by using the <a href="#Bookmark1088"><b>ReadMemory</b></a> function and written using the <a href="#Bookmark1090"><b>WriteMemory</b></a> function.  Pointers in the target's memory can be read and written by using the <a href="#Bookmark1125"><b>ReadPointer</b></a>, <a href="#Bookmark1128"><b>ReadPtr</b></a>, and <a href="#Bookmark1126"><b>WritePointer</b></a> functions.</p>
<p>To search the virtual memory for a pattern of bytes, use the <a href="#Bookmark1089"><b>SearchMemory</b></a> function.</p>
<p>The <a href="#Bookmark1103"><b>TranslateVirtualToPhysical</b></a> function can be used to convert a virtual memory address to a physical memory address.</p>
<p>The <a href="#Bookmark1070"><b>Disasm</b></a> function can be used to disassemble a single assembly instruction on the target.</p>
<p>To check the low 4 GB of memory for corruption when using physical address extension (PAE), use the <a href="#Bookmark1075"><b>Ioctl</b></a> operation <a href="#Bookmark1085"><b>IG_LOWMEM_CHECK</b></a>.</p>
<h3><a id="physical_memory"></a><a id="PHYSICAL_MEMORY"></a>Physical Memory</h3>
<p>Physical memory can only be directly accessed in kernel-mode debugging.</p>
<p>The physical memory on the target can be read by using the <a href="#Bookmark1094"><b>ReadPhysical</b></a> and <a href="#Bookmark1095"><b>ReadPhysicalWithFlags</b></a> functions, and written by using the <a href="#Bookmark1096"><b>WritePhysical</b></a> and <a href="#Bookmark1097"><b>WritePhysicalWithFlags</b></a> functions.</p>
<p>To search the physical memory for pointers to locations within a specified range, use the <a href="#Bookmark1075"><b>Ioctl</b></a> operation <a href="#Bookmark1086"><b>IG_POINTER_SEARCH_PHYSICAL</b></a>.</p>
<h3><a id="other_data_spaces"></a><a id="OTHER_DATA_SPACES"></a>Other Data Spaces</h3>
<p>In kernel-mode debugging, it is possible to read and write data to a variety of data spaces in addition to the main memory.  The following data spaces can be accessed:</p>
<p></p>
<dl>
<dt><a id="Control-Space_Memory"></a><a id="control-space_memory"></a><a id="CONTROL-SPACE_MEMORY"></a>Control-Space Memory</dt>
<dd>
<p>The functions <a href="#Bookmark1104"><b>ReadControlSpace</b></a>, <a href="#Bookmark1105"><b>ReadControlSpace64</b></a>, <a href="#Bookmark1106"><b>ReadTypedControlSpace32</b></a>, and <a href="#Bookmark1107"><b>ReadTypedControlSpace64</b></a> will read data from a control space. The <a href="#Bookmark1108"><b>WriteControlSpace</b></a> function will write data to a control space.</p>
</dd>
<dt><a id="I_O_Memory"></a><a id="i_o_memory"></a><a id="I_O_MEMORY"></a>I/O Memory</dt>
<dd>
<p>The functions <a href="#Bookmark1109"><b>ReadIoSpace</b></a>, <a href="#Bookmark1110"><b>ReadIoSpace64</b></a>, <b>ReadIoSpace64</b>, <a href="#Bookmark1112"><b>ReadIoSpaceEx64</b></a> will read data from system I/O memory and bus I/O memory. The functions <a href="#Bookmark1113"><b>WriteIoSpace</b></a>, <a href="#Bookmark1114"><b>WriteIoSpace64</b></a>, <a href="#Bookmark1115"><b>WriteIoSpaceEx</b></a>, and <a href="#Bookmark1116"><b>WriteIoSpaceEx64</b></a> will write data to system I/O memory and bus I/O memory.</p>
</dd>
<dt><a id="Model_Specific_Register__MSR_"></a><a id="model_specific_register__msr_"></a><a id="MODEL_SPECIFIC_REGISTER__MSR_"></a>Model Specific Register (MSR)</dt>
<dd>
<p>The functions <a href="#Bookmark1091"><b>ReadMsr</b></a> and <a href="#Bookmark1092"><b>WriteMsr</b></a> read and write MSRs.</p>
</dd>
<dt><a id="System_Bus"></a><a id="system_bus"></a><a id="SYSTEM_BUS"></a>System Bus</dt>
<dd>
<p>The <a href="#Bookmark1075"><b>Ioctl</b></a> operations <a href="#Bookmark1082"><b>IG_GET_BUS_DATA</b></a> and <b>IG_SET_BUS_DATA</b> read and write system bus data.</p>
</dd>
</dl>
<h3><a id="additional_information"></a><a id="ADDITIONAL_INFORMATION"></a>Additional Information</h3>
<p>For a more powerful memory access API, see <a href="#Bookmark216">Memory Access</a> in the <a href="#Bookmark204">Using the Debugger Engine API</a> section of this documentation.</p></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
